What about the pathways between the OT and IT networks - aren't those vulnerable to hacking? How do you keep them secure?

A separate OT network allows you to send all OT traffic back to a single point of network connection between IT and OT. This point can be effectively firewalled and monitored for very specific traffic that needs to go through.